Re: [tor-relays] 'critical' security update: Tor 0.2.2.39

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

It is quite sad that one has to find out about 'critical' security updates [0] via an unrelated thread on tor-talk [1] or the blog [2] instead of getting an announcement on tor-announce [3] - where relay operators are probably expecting such information.

Are tor versions 0.2.3.x and 0.2.4.x affected too?

Yes, 0.2.3.x is affected and #6811 is fixed in 0.2.3.22-rc https://gitweb.torproject.org/tor.git/blob/tor-0.2.3.22-rc:/ChangeLog

0.2.3.22-rc was announced by roger as usual on tor-talk: https://lists.torproject.org/pipermail/tor-talk/2012-September/025501.html